Deployment Architecture

Multisite Indexer Clustering: How to configure site_replication_factor for two sites so site2 has its own data and a copy of site1, but have site1 only have its own data?

j4adam
Communicator

Hi all,

I'm demoing out a setup with two sites, but the only thing site 2 has is an Indexer. The only purpose of the second site's indexer is disaster recovery. The idea is that I want site 2 (IDX2) to have a copy of itself and site 1 (IDX1). However, I only want site 1 to have its own data and not a copy of site 2.

I've been playing around with site_replication_factor and the I think the secret lays in the origin, but I'm really having a hard time wrapping my head around it.

Thanks for any information you can provide!

lguinn2
Legend

You can't do it with the search and replication factors.

The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers.
If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...